[BlueZ,1/1] bap: Fix crash in bap_bcast_remove

Commit Message

Iulia Tanasescu July 16, 2024, 8:11 a.m. UTC

This adds a check for the PA request dequeued in bap_bcast_remove,
to avoid accessing a member within a NULL pointer.
---
 profiles/audio/bap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

[e-mail] July 16, 2024, 9:46 a.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=871594

---Test result---

Test Summary:
CheckPatch                    PASS      0.41 seconds
GitLint                       PASS      0.30 seconds
BuildEll                      PASS      24.97 seconds
BluezMake                     PASS      1753.70 seconds
MakeCheck                     PASS      13.13 seconds
MakeDistcheck                 PASS      178.55 seconds
CheckValgrind                 PASS      252.50 seconds
CheckSmatch                   PASS      358.86 seconds
bluezmakeextell               PASS      121.95 seconds
IncrementalBuild              PASS      1489.90 seconds
ScanBuild                     PASS      1025.78 seconds



---
Regards,
Linux Bluetooth

Patch

diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index afa938091..16c02524f 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -3194,7 +3194,7 @@  static void bap_bcast_remove(struct btd_service *service)
 	 */
 	req = queue_remove_if(data->adapter->bcast_pa_requests,
 						match_service, service);
-	if (req->io_id) {
+	if (req && req->io_id) {
 		g_source_remove(req->io_id);
 		req->io_id = 0;
 	}